5 ms·

If the FBI can pay a million for the hack, what's stopping Apple? I'd expect them to be fully aware of it by now.

Someone 11y ago
I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. If you are buying, it doesn't harm to make that public. On the other hand, cases like these may make them consider starting a bug bounty program. and of course, they may already be advertising where it matters (e.g. by calling various hackers, or by using an intermediary to buy hacks) without telling the whole world.
- Rumudiez 11y ago
  I think it would be against Apple's brand image to publicly invite people to break their software, but your last point could be the case in a very limited fashion. Apple has persisted its appearances in shipping stable, valuable software and hardware the first time quite well. No hiccups allowed here. Admitting they can't catch every last bug before release would be killing this advantage in public perception they have over competitors like Microsoft.
  - madeofpalk 11y ago
    I don't think the general public has this perception at all. Many of the non-tech (and tech) people I talk to hold off on updating iOS because they think it's always more buggy. I know people who swear by buying only the S models because they assume by then all the kinks would be ironed out and the phone will be more stable.
- anfedorov 11y ago
  I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. Why is that? It seems to me that there are a lot of ways to run bug bounties, although I haven't thought through the details of Apple keeping theirs official / unofficial, it seems one could have arguments for having none, both, or either, depending on who you are and what kinds of bugs you are trying to get people to tell you about.
- mjolk 11y ago
  Well, even if they're buying, that doesn't mean someone is selling. If I owned an apple tree and merchants were willing to give me $5 per piece of fruit, why would I sell the tree to a farmer for $10? That's assuming that I even want the farmer to know how I grew the tree.
  - corin_ 11y ago
    The farmer could maybe bid even higher than $10 since he's sitting on reserves of $200+ billion.
    - anfedorov 11y ago
      With that kind of reserve, is it possible that Apple simply outbids everyone for any security vulnerability placed on any market they can get in on?
chinathrow 11y ago
It might be a hardware flaw/hack what the company they contracted with had exploited.
joering2 11y ago
> If the FBI can pay a million for the hack, what's stopping Apple? Apple is not a government and does not act "in good faith of all - we the people". In other words - its okay for the GOV to pay a company to extract data from someone's phone (aka "hacking"), it is illegal for a citizen to do so, whether you're paying to crack a phone, or paying to break into someone's house.
- pygy_ 11y ago
  They can do it all they want on their own hardware, it's called 'pen testing' (short for 'penetration').
- Matt3o12_ 11y ago
  Organizations can also legally do that to their employees (assuming that that phone is a company phone). I've heard that some companies are very interested in restoring phones from former employers
nashashmi 11y ago
I don't think Apple would pay. It is a previous gen phone, and Apple isn't going to work very hard to try to secure it. The big question that looms in everyone's mind is if the hack can be used against next gen phones.
- gherkin0 11y ago
  It Apple paid for the exploit, then they could assess if it's usable against next-gen phones.
  - ultramancool 11y ago
    But would they sell to Apple? If they do, they'd lose out on sales to other governments. Apple would probably have to pay far more than other governments who would sit on the exploit privately.
    - misnome 11y ago
      How would they necessarily know that it was apple they were selling to?
      - MichaelGG 11y ago
        Yeah I always wonder what kind of "black ops" such huge companies/fortunes end up with. Do they really not have this kind of stuff? I have first/second-hand knowledge they have fairly competent internal affairs people that will do things akin to spying to find, say, internal corruption. (i.e. a manager in one part of the corp stealing money.) Seems like for critical things they should have no problem setting up fake companies or handling espionage, etc. What stops them, from, say, paying an employee a large bonus to work for a competitor while feeding back information?
      - ultramancool 11y ago
        Depends who they're willing to sell to obviously. If they're only looking to sell to governmental agencies, it should be easy enough to confirm the people they're selling to are such agents. It's definitely true of a $10k exploit which might be readily available on the market, but for something more unique like this they might be more selective with their buyers to protect future profits.
Matt3o12_ 11y ago
Maybe they don't want to sell it to apple because, assuming Apple hasn't already fixed it and it is found in further generation phones, they could sell this exploit once to Apple or to quite a few big companies, governments and other entities. Please keep in mind that we still don't know how they did that. They could have just dumped the flash memory And flashed it again if 10 passcodes failed (my guess), or they might have exploited a software bug.
antihero 11y ago
In a fun turn of events, if Apple bought the exploit and it could be proven that they did, they could be expected to use it at the FBI's request in the future.
- Zhenya 11y ago
  You buy it to learn its function and then patch. The whole idea is to make attack method worthless.
  - antihero 11y ago
    Yeah, but for iPhones that haven't received said patch, you provably know how to exploit them.
intrasight 11y ago
I expect that the FBI bought an exclusive
lysp 11y ago
If I was the 3rd party and was being paid $1m a pop to use the exploit, why would they want to give the details to Apple to get it patched and lose their pay-day?

I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. If you are buying, it doesn't harm to make that public. On the other hand, cases like these may make them consider starting a bug bounty program. and of course, they may already be advertising where it matters (e.g. by calling various hackers, or by using an intermediary to buy hacks) without telling the whole world.

Rumudiez 11y ago
I think it would be against Apple's brand image to publicly invite people to break their software, but your last point could be the case in a very limited fashion. Apple has persisted its appearances in shipping stable, valuable software and hardware the first time quite well. No hiccups allowed here. Admitting they can't catch every last bug before release would be killing this advantage in public perception they have over competitors like Microsoft.
- madeofpalk 11y ago
  I don't think the general public has this perception at all. Many of the non-tech (and tech) people I talk to hold off on updating iOS because they think it's always more buggy. I know people who swear by buying only the S models because they assume by then all the kinks would be ironed out and the phone will be more stable.
anfedorov 11y ago
I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. Why is that? It seems to me that there are a lot of ways to run bug bounties, although I haven't thought through the details of Apple keeping theirs official / unofficial, it seems one could have arguments for having none, both, or either, depending on who you are and what kinds of bugs you are trying to get people to tell you about.
mjolk 11y ago
Well, even if they're buying, that doesn't mean someone is selling. If I owned an apple tree and merchants were willing to give me $5 per piece of fruit, why would I sell the tree to a farmer for $10? That's assuming that I even want the farmer to know how I grew the tree.
- corin_ 11y ago
  The farmer could maybe bid even higher than $10 since he's sitting on reserves of $200+ billion.
  - anfedorov 11y ago
    With that kind of reserve, is it possible that Apple simply outbids everyone for any security vulnerability placed on any market they can get in on?

chinathrow 11y ago

It might be a hardware flaw/hack what the company they contracted with had exploited.

joering2 11y ago

> If the FBI can pay a million for the hack, what's stopping Apple? Apple is not a government and does not act "in good faith of all - we the people". In other words - its okay for the GOV to pay a company to extract data from someone's phone (aka "hacking"), it is illegal for a citizen to do so, whether you're paying to crack a phone, or paying to break into someone's house.

pygy_ 11y ago
They can do it all they want on their own hardware, it's called 'pen testing' (short for 'penetration').
Matt3o12_ 11y ago
Organizations can also legally do that to their employees (assuming that that phone is a company phone). I've heard that some companies are very interested in restoring phones from former employers

nashashmi 11y ago

I don't think Apple would pay. It is a previous gen phone, and Apple isn't going to work very hard to try to secure it. The big question that looms in everyone's mind is if the hack can be used against next gen phones.

gherkin0 11y ago
It Apple paid for the exploit, then they could assess if it's usable against next-gen phones.
- ultramancool 11y ago
  But would they sell to Apple? If they do, they'd lose out on sales to other governments. Apple would probably have to pay far more than other governments who would sit on the exploit privately.
  - misnome 11y ago
    How would they necessarily know that it was apple they were selling to?
    - MichaelGG 11y ago
      Yeah I always wonder what kind of "black ops" such huge companies/fortunes end up with. Do they really not have this kind of stuff? I have first/second-hand knowledge they have fairly competent internal affairs people that will do things akin to spying to find, say, internal corruption. (i.e. a manager in one part of the corp stealing money.) Seems like for critical things they should have no problem setting up fake companies or handling espionage, etc. What stops them, from, say, paying an employee a large bonus to work for a competitor while feeding back information?
    - ultramancool 11y ago
      Depends who they're willing to sell to obviously. If they're only looking to sell to governmental agencies, it should be easy enough to confirm the people they're selling to are such agents. It's definitely true of a $10k exploit which might be readily available on the market, but for something more unique like this they might be more selective with their buyers to protect future profits.

Matt3o12_ 11y ago

Maybe they don't want to sell it to apple because, assuming Apple hasn't already fixed it and it is found in further generation phones, they could sell this exploit once to Apple or to quite a few big companies, governments and other entities. Please keep in mind that we still don't know how they did that. They could have just dumped the flash memory And flashed it again if 10 passcodes failed (my guess), or they might have exploited a software bug.

antihero 11y ago

In a fun turn of events, if Apple bought the exploit and it could be proven that they did, they could be expected to use it at the FBI's request in the future.

Zhenya 11y ago
You buy it to learn its function and then patch. The whole idea is to make attack method worthless.
- antihero 11y ago
  Yeah, but for iPhones that haven't received said patch, you provably know how to exploit them.

intrasight 11y ago

I expect that the FBI bought an exclusive

lysp 11y ago

If I was the 3rd party and was being paid $1m a pop to use the exploit, why would they want to give the details to Apple to get it patched and lose their pay-day?